Questions tagged [key-management]
Key management involves the entire key life-cycle: generation, exchange, storage, safeguarding, use, vetting, revocation, replacement and retirement.
857
questions
506
votes
8
answers
511k
views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
- 13.2k
262
votes
7
answers
51k
views
How do certification authorities store their private root keys?
Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
- 10.7k
240
votes
13
answers
103k
views
Where do you store your personal private GPG key?
So, I want to start using pass, but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated.
Hard ...
- 2,525
233
votes
9
answers
146k
views
Best Practice: ”separate ssh-key per host and user“ vs. ”one ssh-key for all hosts“
Is it better to create a separate SSH key for each host and user or just using the id_rsa key for all hosts to authenticate? Could one id_rsa be malpractice for the privacy/anonymity policies?
having ...
- 2,429
226
votes
9
answers
139k
views
How should I distribute my public key?
I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
- 3,140
173
votes
4
answers
152k
views
Where to store a server side encryption key?
I have some data that is symmetrically encrypted with a single key in my database. Rather than hard coding it into my code, I am looking for a safer way to store the encryption key. Where can I safely ...
- 1,833
151
votes
5
answers
522k
views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
- 5,203
141
votes
11
answers
67k
views
Is it completely safe to publish an ssh public key? [duplicate]
I use a RSA key to log into remote servers with ssh. And I keep my dot files under version control in a publicly accessible place so that I can quickly setup new servers to work the way I like.
...
- 1,381
112
votes
10
answers
80k
views
Should I change the private key when renewing a certificate?
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it's best practice, but my googling ...
- 1,223
101
votes
2
answers
34k
views
How many OpenPGP keys should I make?
I am learning how to use OpenPGP keys in GnuPG, and I am wondering what is the threshold people generally use to maintain separate OpenPGP keys. Maintaining an incredibly large number of keys is not ...
user9117
100
votes
1
answer
9k
views
How are private keys kept private?
This may sound like a stupid question but seriously how are private keys kept private?
If you're someone like Google you have some huge number of servers to which the public can establish secure ...
- 1,155
84
votes
3
answers
33k
views
What is a good general purpose GnuPG key setup?
Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
- 7,868
83
votes
3
answers
22k
views
Does OpenPGP key expiration add to security?
I've created a new OpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised ...
- 1,307
76
votes
6
answers
19k
views
Is using a public-key for logging in to SSH any better than saving a password?
Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
- 3,432
68
votes
5
answers
44k
views
What is a YubiKey and how does it work?
How do YubiKeys work? Are there any alternatives?
Here is a picture of one:
- 1,515
67
votes
3
answers
14k
views
Why shouldn't I bring a computer to a key-signing party?
I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event:
Things to bring
no computer
What ...
- 1,260
53
votes
1
answer
32k
views
Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?
Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs:
Stop using 32bit key ids
It takes 4 seconds to generate ...
- 24.6k
50
votes
5
answers
15k
views
Migrating GPG master keys as subkeys to new master key
Currently I have 3 private GPG pairs which are all master keys.
I want to convert these keys into subkeys for a new key pair (and keep that in the vault).
I have read the following thread http://...
- 601
50
votes
4
answers
14k
views
What's the common pragmatic strategy for managing key pairs?
I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH.
Originally when I learned about PKI, I created a single ...
- 825
49
votes
4
answers
38k
views
What vulnerabilities could be caused by a wildcard SSL cert?
In a comment on this answer, AviD says:
"There are numerous security issues with wildcard SSL certs."
So, what are the problems? I understand that the same private key is being used in multiple ...
user185
48
votes
2
answers
16k
views
Criteria for Selecting an HSM
A very sensitive application has to protect several different forms of data, such as passwords, credit cards, and secret documents - and encryption keys, of course.
As an alternative to developing a ...
AviD♦
- 73.3k
48
votes
2
answers
21k
views
Web Application encryption key management
In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions:
...
- 591
47
votes
4
answers
19k
views
Security of passphrase-protected private key
If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
- 13.2k
41
votes
7
answers
109k
views
Extracting the PGP keyid from the public key file
Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block?
I found the hexa value of the key in the binary file, but I guess the position is based on ...
- 513
40
votes
1
answer
38k
views
Should I publish my public SSH key with user@hostname at the end?
In ~/.ssh/id_rsa.pub my public key is stored as:
ssh-rsa magicmagicmagicmagic...magicmagic username@hostname
When publishing my public key, should I include the username@hostname bit? Can I ...
- 3,610
39
votes
4
answers
24k
views
Passing secret keys securely to docker containers
I want to pass a secret value needed by an app that runs in a Docker container. This particular container is short-lived -- it starts up, runs a command, and then terminates.
Method 1: Pass the ...
- 1,179
38
votes
3
answers
23k
views
What does it mean for a digital certificate to be "signed"?
When someone says that a particular digital certificate (like an SSL cert) has been "signed with a key", what does that imply? Does that mean the certificate simply includes a key that should be used ...
- 951
37
votes
2
answers
9k
views
Protecting a private key by spreading it over multiple places
Is it safe to split a private key file and put it in different locations?
I mean can somebody actually do anything with only a part of a key?
- 493
37
votes
2
answers
7k
views
I accidentally published my SSH key passphrase, what to do?
So I mistook input fields and now my SSH key passphrase is visible to the world, and I can't even remove it.
Now as far as I understand, this is not an immediate security concern, since the ...
34
votes
1
answer
22k
views
JSON Web Tokens - How to securely store the key?
I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The conceptual core of this method is that the server is the only ...
- 443
33
votes
5
answers
78k
views
Compute the AES-encryption key given the plaintext and its ciphertext?
I'm tasked with creating database tables in Oracle which contain encrypted
strings (i.e., the columns are RAW). The strings are encrypted by the application
(using AES, 128-bit key) and stored in ...
33
votes
1
answer
33k
views
Are SSH keys and PGP keys the same thing?
I have a 3072 bit RSA key that I generated for use with SSH. Can this key-pair be used with PGP/GPG, or do I need to generate a new pair of keys separately for use in email encryption?
Are the two ...
- 6,845
32
votes
7
answers
12k
views
How great is the risk in publicly sharing part of a private key?
If two people want to check they have the same (say 256 bit) private key, how great is the risk in sharing the first say 8 chars over a potentially public channel?
Can an attacker recover any more ...
- 482
32
votes
3
answers
55k
views
How can I securely convert a "string" password to a key used in AES?
I'm writing some software where I have to encrypt all files that are written to a specific folder using AES. There is one password/key that is configured somewhere, which is always used.
I don't want ...
- 443
30
votes
6
answers
23k
views
How are ProtonMail keys distributed?
There is a service called ProtonMail.
It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system "...
- 301
30
votes
2
answers
49k
views
Creating user specific authentication methods in SSH
I have configured sshd on an Ubuntu server to use key authentication and it is working fine.
I had to disable password authentication for key authentication to work.
Server is always accessed via ...
- 411
30
votes
2
answers
12k
views
How can WhatsApp restore local or Google Drive Backups?
This is all not about their end-to-end transmission protocol and my question is mostly Android centric.
What I ask myself:
When reading about hacking and decrypting local WhatsApp database backups it ...
- 425
30
votes
3
answers
37k
views
OpenSSH declares ssh-rsa deprecated. What do I do next?
With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults:
Future deprecation notice
It is now possible[1] to perform chosen-prefix attacks ...
- 2,630
30
votes
3
answers
13k
views
What useful things can I do with the html5 "keygen" element?
There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari.
Here's what it looks like:
<form action="processkey.cgi" method="post" ...
- 961
29
votes
4
answers
6k
views
How can PrivateSky not see your data?
PrivateSky is a website that promises encrypted "cloud-like" secure information exchange. They promise that except the sender and receiver, nobody can see your data. After testing it yesterday, I do ...
- 595
29
votes
6
answers
8k
views
Shouldn't GPG key fetching use a secure connection?
If I run this for example:
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451
then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
- 6,279
27
votes
2
answers
41k
views
GnuPG asks for a key ID when sharing my public key, what is that?
I generated a public key using GnuPG. I can see it using --list-keys
$ gpg --list-keys
/Users/mertnuhoglu/.gnupg/pubring.gpg
-------------------------------------
pub 4096R/CB3AF6E6 2015-12-24 [...
- 373
26
votes
4
answers
9k
views
What are the chances to generate the same ssh key?
I could generate ssh keys on the client like (without password):
ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v
and copy the generated id_rsa.pub to the server:
ssh-copy-id -i /...
- 6,279
24
votes
6
answers
62k
views
What does "key with length of x bits" mean?
I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
- 351
24
votes
3
answers
60k
views
DEK, KEK and Master key - simple explanation
This article is intended to be a simplified explanation sans drill-down for people wanting to understand these concepts/terms.
What are DEK, KEK and MEK/Master key?
- 363
24
votes
1
answer
13k
views
How to crack (get secret from) Android Keystore System
I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
- 359
22
votes
5
answers
47k
views
How can I explain the concept of public and private keys without technical jargon? [duplicate]
Possible Duplicate:
Principle of asymmetric algorithm in plain english
In the spirit of How can I explain SQL injection without technical jargon?, do you have any suggestions on how to explain ...
- 320
22
votes
6
answers
25k
views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
- 50.9k
22
votes
1
answer
4k
views
Is assigning decrypted keys to a variable in application secure? [duplicate]
Let's say I've retrieved an encrypted secret key from the server. I decrypt it to get the actual secret key, assign the decrypted key to a variable in my app. Something along this:
const encryptedKey ...
- 367
22
votes
3
answers
4k
views
Which signing key should I use for certifying other peoples public keys: master or subkey?
I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA).
I sign documents with the signing subkey: GnuPG selects this key ...
- 410